credentials = decryptCredentials(credentials);
Server server = Server.getCurrent();
Authenticator auth = getAuth();
if (credentials instanceof SelfEncryptedCookie) {
SelfEncryptedCookie cookie = (SelfEncryptedCookie) credentials;
// XXX: cred timeout
String adminCookie = server.getAdminCookie();
if (adminCookie == null)
adminCookie = "";
if (! cookie.getCookie().equals(adminCookie)) {
throw new NotAuthorizedException(L.l("'{0}' has invalid credentials",
uid));
}
}
else if (auth == null && ! _isAuthenticationRequired) {